Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Take an existing app repo (your own) and add a DevSecOps CI pipeline that runs on every pull request. Requirements: add SECRET SCANNING (gitleaks) as a pre-commit hook and/or CI step; add SAST (e.g. Semgrep) on the diff; add DEPENDENCY (SCA) scanning for known CVEs (Dependabot / Snyk / OWASP Dependency-Check); apply RISK-BASED GATING — fail the build on high/critical findings but only warn (and track) on low; and remove any hardcoded secret you find, moving it to an environment variable or secret store (and note that a real leaked secret must be rotated). Document what each scanner catches and why you gated by severity. Defensive only — scanning code you own.
Secret scanning + SAST + SCA wired into CI on pull requests, each catching its class of issue.
Fail the build on high/critical, warn (and track) on low — explained so the pipeline stays usable and trusted.
No hardcoded secrets — moved to env/secret store; removal + rotation reasoning documented.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# Add a security-scanning CI pipeline to a repo ## Goal Take an existing app repo (your own) and add a DevSecOps CI pipeline that runs on every pull request. Requirements: add SECRET SCANNING (gitleaks) as a pre-commit hook and/or CI step; add SAST (e.g. Semgrep) on the diff; add DEPENDENCY (SCA) scanning for known CVEs (Dependabot / Snyk / OWASP Dependency-Check); apply RISK-BASED GATING — fail the build on high/critical findings but only warn (and track) on low; and remove any hardcoded secret you find, moving it to an environment variable or secret store (and note that a real leaked secret must be rotated). Document what each scanner catches and why you gated by severity. Defensive only — scanning code you own. ## Acceptance criteria - [ ] Scanning coverage: Secret scanning + SAST + SCA wired into CI on pull requests, each catching its class of issue. - [ ] Risk-based gating: Fail the build on high/critical, warn (and track) on low — explained so the pipeline stays usable and trusted. - [ ] Secret hygiene: No hardcoded secrets — moved to env/secret store; removal + rotation reasoning documented. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.